Fixing ERROR_NOT_SAFEBOOT_SERVICE (0x0000043C) in Safe Mode

You're booting into Safe Mode on Windows Server 2019 or Windows 10/11 to troubleshoot a driver issue, and you try to start a service — maybe the Windows Firewall or a third-party agent like Symantec Endpoint Protection. Instead of starting, you get: ERROR_NOT_SAFEBOOT_SERVICE (0x0000043C) - This service cannot be started in Safe Mode. The service just sits there, greyed out in services.msc, and the Event Log shows the 0x0000043C error with no additional detail. I've seen this on everything from domain controllers to standalone SQL servers.

What's actually happening

Safe Mode loads a minimal set of drivers and services — basically just the kernel, storage stack, and critical system services. Any service marked with a SERVICE_DEMAND_START or SERVICE_AUTO_START that isn't in the Safe Mode service list gets blocked. The Windows Service Control Manager (SCM) literally reads a registry key to decide what's allowed. If your service isn't listed there, you get 0x0000043C.

The root cause is usually one of two things:

• Dependency chain break: The service depends on another service or driver that's not loaded in Safe Mode. SCM sees the missing dependency and bails out.
• Service startup type set incorrectly: Someone set the service to Automatic or Manual but didn't configure it for Safe Mode loading. It's not malicious — just a config oversight.

The fix — step by step

You have two options. Pick the one that fits your situation.

Option A: Add the service to Safe Mode (quick fix)

1. Boot into Safe Mode with Networking (if you need network access) or regular Safe Mode.
2. Open Registry Editor (regedit) as Administrator.
3. Go to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal for regular Safe Mode, or HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network for Safe Mode with Networking.
4. Right-click the SafeBoot key, choose New > Key. Name it exactly the service's display name (case-sensitive). For example, Windows Firewall or Symantec Endpoint Protection.
5. Inside that new key, create a String Value named (Default) and set its data to Service.
6. Close regedit, then run net start <ServiceName> or start it via services.msc.

Option B: Fix the service's own registry (permanent)

This is better if you plan to boot into Safe Mode again later and want the service to just work.

1. Boot normally (not Safe Mode).
2. Open Regedit as Administrator.
3. Go to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<ServiceName>
4. Look for the Start value. Set it to 2 for automatic, 3 for manual. Don't set it to 4 (disabled).
5. Also check if there's a DependOnService multi-string value. If it references a service that doesn't load in Safe Mode (like LanmanServer or RpcSs), remove that dependency temporarily.
6. Reboot into Safe Mode and try starting the service.

What to check if it still fails

If neither fix works, don't waste time guessing. Here's what I check next:

• Event Viewer > System log: Filter by source Service Control Manager. Look for Event ID 7000 or 7023. It'll tell you which dependency is missing.
• Run sc qc <ServiceName> from an admin command prompt. Look at the DEPENDENCIES line. If it shows a service that's not running, that's your blocker.
• Check the driver stack: Some services depend on kernel drivers (DependOnGroup). In Safe Mode, many driver groups are skipped. You'll need to add the driver group to the Safe Mode list using the same registry trick above, but under SafeBoot\Minimal or SafeBoot\Network.
• Third-party security software: Products like McAfee, CrowdStrike, or Trend Micro often hook into the boot process. If the service you're starting is a dependency of that security suite, you might need to temporarily disable the suite's filter driver. Boot normally, stop the security service, then retry.

One last thing: If you're running Windows Server 2012 R2 or older, the registry path is the same but the Safe Boot list is sometimes case-sensitive. I've seen failures because someone typed Windows Firewall instead of Windows Firewall — yes, the space matters. Use sc query to get the exact display name.

That's it. This error is annoying but straightforward once you know where to look. You'll fix it in under 10 minutes.